Test Lab Guide: Base Configuration
Microsoft Corporation
Published: July 2010
Updated: March 2011
Abstract
This Microsoft Test Lab Guide (TLG) provides you with step-by-step instructions to create the Base Configuration test lab, upon which you can build test labs based on other TLGs from Microsoft and published in the TechNet Wiki, perform TLG extensions in the TechNet Wiki, or create a test lab of your own design that can include Microsoft or non-Microsoft products. For a test lab based on physical computers, you can image the drives for future test labs. For a test lab based on virtualized computers, you can create snapshots of the base configuration virtual machines. This enables you to easily return to the base configuration test lab, where most of the routine infrastructure and networking services have already been configured, so that you can focus on building a test lab for the product, technology, or solution of interest.
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
The Test Lab Guide: Base Configuration is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred.
© 2010 Microsoft Corporation. All rights reserved.
Date of last update: March9, 2011
Microsoft, Windows, Active Directory, Internet Explorer, and WindowsServer are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
Contents
Introduction
In this guide
Test lab overview
Hardware and software requirements
Steps for Configuring the Corpnet Subnet
Step 1: Configure DC1
Install the operating system on DC1
Configure TCP/IP properties
Configure DC1 as a domain controller and DNS server
Install and configure the DHCP server role on DC1
Install an enterprise root CA on DC1
Configure the CRL distribution settings
Create a DNS record for crl.corp.contoso.com
Create a user account in Active Directory
Configure computer certificate auto-enrollment
Configure computer account maximum password age
Step 2: Configure APP1
Install the operating system on APP1
Configure TCP/IP properties
Join APP1 to the CORP domain
Install the Web Server (IIS) role on APP1
Create a web-based CRL distribution point
Configure the HTTPS security binding
Configure permissions on the CRL distribution point file share
Publish the CRL to APP1 from DC1
Create a shared folder on APP1
Step 3: Configure CLIENT1
Install the operating system on CLIENT1
User account control
Join CLIENT1 to the CORP domain
Verify the computer certificate
Test access to intranet resources from the Corpnet subnet
Steps for Configuring the Internet Subnet
Step 1: Configure EDGE1
Install the operating system on EDGE1
Configure TCP/IP properties
Join EDGE1 to the CORP domain
Step 2: Configure INET1
Install the operating system on INET1
Configure TCP/IP properties
Rename the computer
Install the Web Server (IIS) and DNS server roles
Create DNS records
Install and configure the DHCP server role on INET1
Configure the NCSI web site
Test access to Internet resources from the Internet subnet
Snapshot the Configuration
Additional Resources
Appendices
Appendix A: Set UAC Behavior of the Elevation Prompt for Administrators
Appendix B: Resulting Configuration
Computers
DC1
APP1
EDGE1
CLIENT1
INET1
Active Directory and DNS infrastructure
Web infrastructure
PKI
Introduction
Test Lab Guides (TLGs) allow you to get valuable hands-on experience with new products and technologies using a pre-defined and tested methodology that results in a working configuration. When you use a TLG to create a test lab, instructions define what servers to create, how to configure the operating systems and system services, and how to install and configure any additional products or technologies. A TLG experience enables you to see all of the components and the configuration steps on both the front-end and back-end that are required for a product or technology or for a multi-product or technology solution.
A challenge in creating useful TLGs is to enable their reusability and extensibility. Because creating a test lab can represent a significant investment of time and resources, your ability to reuse and extend the work required to create test labs is important. An ideal test lab environment would enable you to create a basic lab configuration, save that configuration, and then build out multiple test labs in the future by starting with the base configuration.
The purpose of this TLG is to enable you to create the Base Configuration test lab, upon which you can build a test lab based on other TLGs from Microsoft or published in the TechNet Wiki, perform TLG extensions in the TechNet Wiki, or create a test lab of your own design that can include Microsoft or non-Microsoft products.
Depending on how you deploy your test lab environment, you can image the drives for the Base Configuration test lab if you are using physical computers or you can create snapshots of the Base Configuration test lab virtual machines. This enables you to easily return to baseline configuration where most of the routine client, server, and networking services have already been configured so that you can focus on building out a test lab for the products or technologies of interest. For this reason, make sure that you create disk images or virtual machine snapshots after completing all the steps in this TLG.
The Base Configuration TLG is just the beginning of the test lab experience. Other TLGs or TLG extensions in the TechNet Wiki focus on Microsoft products or platform technologies, but all of them use this Base Configuration TLG as a starting point.
In this guide
This document contains instructions for setting up the Base Configuration test lab by deploying four server computers running Windows Server2008R2 Enterprise Edition and one client computer running Windows7 Enterprise or Ultimate. The resulting configuration simulates a private intranet and the Internet.
Important
The following instructions are for configuring the Base Configuration test lab. Individual computers are needed to separate the services provided on the network and to clearly show the desired functionality. This configuration is neither designed to reflect best practices nor does it reflect a desired or recommended configuration for a production network. The configuration, including IP addresses and all other configuration parameters, is designed only to work on a separate test lab network.
Test lab overview
The Base Configuration test lab consists of the following:
One computer running Windows Server2008R2 Enterprise Edition named DC1 that is configured as an intranet domain controller, Domain Name System (DNS) server, Dynamic Host Configuration Protocol (DHCP) server, and an enterprise root certification authority (CA).
One intranet member server running Windows Server2008R2 Enterprise Edition named APP1 that is configured as a general application and web server with secure sockets layer (SSL) support. APP1 also hosts the certificate revocation list (CRL) for the enterprise root CA installed on DC1.
One roaming member client computer running Windows7 Enterprise or Ultimate named CLIENT1.
One intranet member server running Windows Server2008R2 Enterprise Edition named EDGE1 that is configured as an Internet edge server.
One standalone server running Windows Server2008R2 Enterprise Edition named INET1 that is configured as an Internet DNS server, web server, and DHCP server.
The Base Configuration test lab consists of two subnets that simulate the following:
The Internet, referred to as the Internet subnet (131.107.0.0/24).
An intranet, referred to as the Corpnet subnet (10.0.0.0/24), separated from the Internet subnet by EDGE1.
Computers on each subnet connect using a physical hub, switch, or virtual switch. See the following figure for the configuration of the Base Configuration test lab.
This document describes how to build out the Base Configuration test lab in two sections:
Steps for configuring the Corpnet subnet (DC1, APP1, and CLIENT1)
Steps for configuring the Internet subnet (EDGE1 and INET1)
Some TLGs require only the Corpnet subnet. However, it is strongly recommended that you build out both subnets if you ever plan to test technologies, products, or solutions that include access to intranet servers and services from the Internet. The Base Configuration test lab environment consisting of both subnets can be saved and reused for other TLGs. By building out both the Corpnet and Internet subnets, you will have a reusable snapshot of the entire Base Configuration test lab that can be used for intranet and Internet-based TLGs, which has the starting Base Configuration test lab in a unified and consistent state.
Hardware and software requirements
The following are required components of the test lab:
The product disc or files for Windows Server2008R2 Enterprise Edition.
For an evaluation copy of Windows Server 2008 R2 Enterprise Edition in download and virtual hard disk (VHD) form, see Windows Server 2008 R2 Evaluation Free 180-Day Trial (
The product disc or files for Windows7 Enterprise or Ultimate.
For an evaluation copy of Windows 7 Enterprise in download form, see Windows 7 Enterprise 90-day Trial (
Four computers that meet the minimum hardware requirements for Windows Server2008R2 Enterprise Edition. One of these computers (EDGE1) has two network adapters installed.
One computer that meets the minimum hardware requirements for Windows7 Enterprise or Ultimate.
If you wish to deploy the Base Configuration test lab in a virtualized environment, your virtualization solution must support Windows Server2008R2 Enterprise Edition and Windows7 Enterprise or Ultimate 64-bit virtual machines. The server hardware must support the amount of RAM required to run the virtual operating systems included in the Base Configuration test lab and any other virtual machines required by additional TLGs.
Important
Run Windows Update on all computers or virtual machines either during the installation or immediately after installing the operating systems. After running Windows Update, you can isolate your physical or virtual test lab from your production network.
Steps for Configuring the Corpnet Subnet
There are three steps to setting up the Corpnet subnet of the Base Configuration test lab.
1.Configure DC1.
2.Configure APP1.
3.Configure CLIENT1.
Note
You must be logged on as a member of the Domain Admins group or a member of the Administrators group on each computer to complete the tasks described in this guide. If you cannot complete a task while you are logged on with an account that is a member of the Administrators group, try performing the task while you are logged on with an account that is a member of the Domain Admins group.
The following sections provide details about how to perform these steps.
Step 1: Configure DC1
DC1 provides the following services:
A domain controller for the corp.contoso.com Active Directory Domain Services (AD DS) domain.
A DNS server for the corp.contoso.com DNS domain.
A DHCP server for the Corpnet subnet.
An enterprise root CA for the corp.contoso.com domain.
DC1 configuration consists of the following:
Install the operating system.
Configure TCP/IP.
Install Active Directory and DNS.
Install DHCP.
Install an enterprise root CA.
Configure the CRL settings for the enterprise root CA.
Create a DNS entry for crl.corp.contoso.com.
Create a user account in Active Directory.
Configure computer certificate auto-enrollment.
Configure computer account maximum password age.
Install the operating system on DC1
First, install Windows Server2008R2 Enterprise Edition as a standalone server.
To install the operating system on DC1
1.Start the installation of Windows Server2008R2.2.Follow the instructions to complete the installation, specifying Windows Server2008R2 Enterprise Edition (full installation) and a strong password for the local Administrator account. Log on using the local Administrator account.
3.Connect DC1 to a network that has Internet access and run Windows Update to install the latest updates for Windows Server2008R2.
4.Connect DC1 to the Corpnet subnet.
Configure TCP/IP properties
Next, configure the TCP/IP protocol with a static IP address of 10.0.0.1 and the subnet mask of 255.255.255.0.
To configure TCP/IP on DC1
1.In Initial Configuration Tasks, click Configure networking.2.In Network Connections, right-click Local Area Connection, and then click Properties.
3.Click Internet Protocol Version 4 (TCP/IPv4), and then click Properties.
4.Select Use the following IP address. In IP address, type 10.0.0.1. In Subnet mask, type 255.255.255.0. Select Use the following DNS server addresses. In Preferred DNS server, type 10.0.0.1.
5.Click Advanced, and then click the DNS tab.
6.In DNS suffix for this connection, type corp.contoso.com, click OK twice, and then click Close.
7.Close the Network Connections window.
8.In Initial Configuration Tasks, click Provide computer name and domain.
9.In System Properties, click Change. In Computer name, type DC1, click OK twice, and then click Close. When you are prompted to restart the computer, click Restart Now.
10.After restarting, login using the local administrator account.
11.In Initial Configuration Tasks, click Do not show this window at logon, and then click Close.
Configure DC1 as a domain controller and DNS server
Next, configure DC1 as a domain controller and DNS server for the corp.contoso.com domain.
To configure DC1 as a domain controller and DNS server
1.In the console tree of Server Manager, click Roles. In the details pane, click Add Roles, and then click Next.2.On the Select Server Roles page, click Active Directory Domain Services, click Add Required Features, click Next twice, and then click Install. When installation is complete, click Close.
3.To start the Active Directory Installation Wizard, click Start, type dcpromo, and then press ENTER.
4.In the Active Directory Installation Wizard dialog box, click Next twice.
5.On the Choose a Deployment Configuration page, click Create a new domain in a new forest, and then click Next.
6.On the Name the Forest Root Domain page, type corp.contoso.com, and then click Next.
7.On the Set Forest Functional Level page, in Forest Functional Level, click Windows Server 2008 R2, and then click Next.
8.On the Additional Domain Controller Options page, click Next, click Yes to continue, and then click Next.
9.On the Directory Services Restore Mode Administrator Password page, type a strong password twice, and then click Next.
10.On the Summary page, click Next.
11.Wait while the wizard completes the configuration of Active Directory and DNS services, and then click Finish.
12.When you are prompted to restart the computer, click Restart Now.
13.After the computer restarts, log in to the CORP domain using the Administrator account.
Install and configure the DHCP server role on DC1
Next, configure DC1 as a DHCP server so that CLIENT1 can automatically configure itself when it connects to the Corpnet subnet.
To install and configure the DHCP server role
1.In the console tree of Server Manager, click Roles.2.In the details pane, under Roles Summary, click Add roles, and then click Next.
3.On the Select Server Roles page, click DHCP Server, and then click Next twice.
4.On the Select Network Connection Bindings page, verify that 10.0.0.1 is selected, and then click Next.
5.On the Specify IPv4 DNS Server Settings page, verify that corp.contoso.com is listed under Parent domain.
6.Type 10.0.0.1 under Preferred DNS server IP address, and then click Validate. Verify that the result returned is Valid, and then click Next.
7.On the Specify WINS Server Settings page, accept the default setting of WINS is not required on this network, and then click Next.
8.On the Add or Edit DHCP Scopes page, click Add.
9.In the Add Scope dialog box, type Corpnet next to Scope Name. Next to Starting IP Address, type 10.0.0.100, next to Ending IP Address, type 10.0.0.150, and next to Subnet Mask, type 255.255.255.0. Click OK, and then click Next.
10.On the Configure DHCPv6 Stateless Mode page, select Disable DHCPv6 stateless mode for this server, and then click Next.
11.On the Authorize DHCP Server page, select Use current credentials. Verify that CORP\Administrator is displayed next to User Name, and then click Next.
12.On the Confirm Installation Selections page, click Install.
13.Verify the installation was successful, and then click Close.
Install an enterprise root CA on DC1
Next, install an enterprise root CA on DC1 to provide digital certificates for domain member computers.